topic Re: How do I force a universal forwarder to reindex all its inputs? in Getting Data In

How do I force a universal forwarder to reindex all its inputs?

daniel333 — Mon, 13 Jun 2016 22:38:58 GMT

All,

Is there a way to make a Universal Forwarder reindex all its inputs?

thanks
-Daniel

Re: How do I force a universal forwarder to reindex all its inputs?

woodcock — Mon, 13 Jun 2016 22:44:38 GMT

Reset the fishbucket with btprobe:

http://docs.splunk.com/Documentation/Splunk/6.4.1/Troubleshooting/CommandlinetoolsforusewithSupport

Re: How do I force a universal forwarder to reindex all its inputs?

ddrillic — Mon, 13 Jun 2016 23:06:38 GMT

A sensational explanation at How to reindex data from a forwarder

Re: How do I force a universal forwarder to reindex all its inputs?

MuS — Tue, 14 Jun 2016 02:06:37 GMT

Hi daniel333,

btool is used to view or validate Splunk config files.
Probably btprobe was meant in the previous answer, which enables you to remove fish bucket information for a specific file.
Easiest way to re-index all inputs on a universal forwarder is to delete the fish bucket index while Splunk UF is stopped:

 $SPLUNK_HOME/bin/splunk stop
 rm -rf $SPLUNK_HOME/var/lib/splunk/fishbucket
 $SPLUNK_HOME/bin/splunk start

Splunk will re-create the fish bucket index and immediately re-index all the inputs on your universal forwarder, so watch out for your license usage 😉

cheers, MuS

Re: How do I force a universal forwarder to reindex all its inputs?

vpassaro — Wed, 16 Jan 2019 22:45:38 GMT

404 -- not found

Re: How do I force a universal forwarder to reindex all its inputs?

spl_unker — Thu, 24 Feb 2022 12:03:09 GMT

is there a way to clear fishbucket without reindexing? In one of the old UF , fishbucket file has occupied complete disk space and i need to clear the file to run Splunk again.